Health Care Malware Kwampirs in Details

<div dir="ltr" style="text-align: left;" trbidi="on"> This post is about kwampirs malware which is targeting health care malware majorly, in this post I will share my recent experience with this malware identification as well as tips to make your system free from this malware.<br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgY_aTwUT2QFIInaSnyJjOCYBGgvQKlq93aH8Vz6gmfrkrBiR7QRnFBu2eOHom5FFl0AwQoguuWYZJolujamYVOudzWlEi2LhXO3p-Xzy8BIlxWaBQmzKL57lrmLuguLcW2OwsNePaEYbUs/s1600/kwampirs.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="510" data-original-width="1181" height="276" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgY_aTwUT2QFIInaSnyJjOCYBGgvQKlq93aH8Vz6gmfrkrBiR7QRnFBu2eOHom5FFl0AwQoguuWYZJolujamYVOudzWlEi2LhXO3p-Xzy8BIlxWaBQmzKL57lrmLuguLcW2OwsNePaEYbUs/s640/kwampirs.jpg" width="640" /></a></div> <h2> About Kwampirs:</h2> <br /> Kwampirs is basically a backdoor trojan used by hackers to gain remote access to compromised computers. When executed, the Trojan decrypts and extracts a copy of its main DLL payload. Kwampirs target WMI performance adapter service present in windows and upon infection it makes the service as WMI Performance Adapter Extension (WmiApSrvEx) type autostart.It only targets windows system that doesn't any sort of security prevention mechanism such as the latest antivirus.It doesn't have anything to deal with Linux/Mac environment.<br /> <br /> <h2> How to check for kwampirs infection?</h2> In your system go run (win+R) type services.msc.<br /> <div class="separator" style="clear: both; text-align: center;"> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPmx5iTVkIf2lzQVz5-5oZYkn1IdMEy2Yw_RENcmDP5tngITDx0GfligMswUX-AclIUkR0y_kOMk-hwDnV5yTCxSTFMWDfKQh5MmhJ9SPUPWDSOnj-qrFOlvhYBp7tLg6Xd83nrDAFpZOC/s1600/service.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" data-original-height="259" data-original-width="404" height="205" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPmx5iTVkIf2lzQVz5-5oZYkn1IdMEy2Yw_RENcmDP5tngITDx0GfligMswUX-AclIUkR0y_kOMk-hwDnV5yTCxSTFMWDfKQh5MmhJ9SPUPWDSOnj-qrFOlvhYBp7tLg6Xd83nrDAFpZOC/s320/service.jpg" width="320" /></a></div> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> <br /> Check for the service WmiApSrvEx (<b>WMI Performance Adapter Extension</b>) if it is in running /stopped state means it is infected with kwampirs.<br /> <br /> <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnnklVk02cQF-8LV63hZ1I11KNrgzJHBxXRHM0GIsp-p_cLmVJxioVHqrSxyJj3NQ78ix90WOZcgzvJqMeu0_4Ya5wvR61YzCJijf9AL5njZX_6v5kwtkFV2ZQurA4AcA4SIS-TcyprXHM/s1600/infection.jpg" imageanchor="1"><img border="0" data-original-height="321" data-original-width="593" height="173" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnnklVk02cQF-8LV63hZ1I11KNrgzJHBxXRHM0GIsp-p_cLmVJxioVHqrSxyJj3NQ78ix90WOZcgzvJqMeu0_4Ya5wvR61YzCJijf9AL5njZX_6v5kwtkFV2ZQurA4AcA4SIS-TcyprXHM/s320/infection.jpg" width="320" /></a><br /> <br /> You can also check for the infection using the registry.<br /> <b><br /> Key Path:</b> <i>CurrentControlSet\Services\WmiApSrvEx\</i><br /> <b>Path:</b> <i>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WmiApSrvEx</i><br /> <br /> Not only that you can also have a look in system folder such as c:\Windows\System32\ & C:\windows\SYSWOW64 for service name (.exe)<br /> wmiapsrvce<br /> wmipsrvce<br /> wmiapsrvcep<br /> wmiapsvrce<br /> etc or dll <br /> wmiamgmt<br /> wmiassn<br /> wmipadp<br /> <br /> Also some .PNF files are associated with the malware:<br /> C:\Windows\inf\mtmndkb32.pnf<br /> C:\Windows\inf\digirps.pnf<br /> Etc<br /> <br /> <h2> Target Systems :</h2> A system with no Antivirus protection.<br /> Older XP Or server 2000/2008 system which is not managed properly.<br /> <br /> <h2> Steps to Make your network Kwampirs Infection Free:</h2> Make sure all the system are having the latest antivirus protection.<br /> If a certain group system such as XP where you can't have antivirus protection make sure they are operated in an isolated network.<br /> <br /> Hope these post help you to know details about kwampirs.<br /> <br /> Please do provide a view on this, if you have any query i will definitely try my level best to answer.</div>

Health Care Malware Kwampirs in Details

This post is about kwampirs malware which is targeting health care malware majorly, in this post I will share my recent experience with thi...

Read more »